Privacy Policy

This page is written in plain language. It is a draft that is being reviewed by a lawyer, and we will update it if anything changes as a result.

Information we collect

Your OfficeBats account

• Username, display name, email address and whether it is verified, and any older usernames that still sign you in.
• Your password, stored only as a salted scrypt hash. We cannot see it.
• Two factor settings: the authenticator secret (encrypted) and hashed recovery codes.
• When you agreed to these Terms and this policy, and which version.
• Your plan, subscriptions, storage add ons and AI credit balance, and a ledger of AI credit use that records which app used credits and when.
• Which Bats apps your account is linked to, and when you last signed in to each.

Content in the apps

• PDFbat and DocsBat: files you upload, create or edit, tool results saved to your Drive, folders and share links, AI chats and their documents.
• E-signatures: documents you send, the names and emails of recipients, fields, signatures and values signers enter, and an audit trail with IP addresses, browser user agents, timestamps and document hashes. The audit trail is shared with everyone on the envelope.
• FormsBat: forms you build and the responses people submit, including uploaded files and documents generated from responses.
• BooksBat: your business records, such as customers, vendors, invoices, quotes, expenses, receipts, bank statement imports and reports, and the connection details for payment providers you connect (stored encrypted).
• Buildan.app: sites, pages, CMS content, media, form submissions and store orders on sites you build, and visitor statistics collected without cookies.

Guests

Some tools can be tried without an account. Guest files are processed in memory, the result is sent back to your browser, and the files are deleted when processing ends. We keep a daily usage count for your network address so guest use stays within its limit.

Technical information

• IP address, browser type and request logs, used for security, rate limiting, fraud prevention and fixing errors.
• Error reports when a page fails, without the content of your documents.
• If you accept analytics cookies on officebats.com: usage statistics from Google Analytics, such as pages visited, device and browser, and approximate location (see Cookies).

Payments

Payments for your plan are handled by Stripe. We never see or store your full card number. We keep your Stripe customer and subscription identifiers, plan status and invoice history.

How we use information

• To provide the service: sign you in to every app, run tools, save files, send and complete envelopes, collect form responses, send invoices, publish sites and answer AI requests.
• To keep accounts secure: sign in, two factor authentication, rate limits, abuse prevention and audit trails.
• To send service email: email confirmation, password reset, security notices, signature requests, reminders and receipts. We do not send marketing email without your consent.
• To bill you for your plan, storage add ons and AI credits.
• To understand how the products are used in aggregate and improve them.
• To meet legal obligations, such as tax records and responding to valid legal requests.

Where the GDPR applies, we rely on performing our contract with you, our legitimate interest in keeping the service secure and working, your consent where we ask for it, and legal obligations.

AI features

When you use an AI feature in any app (for example chat with a document, summarize, translate, extract, write, generate a form or build a website), the relevant content and your request are sent to AI service providers that process it to return an answer. AI service providers process this data on our behalf under contract, and we choose providers that do not use API data to train their models. We do not use your content to train AI models.

Service providers

We share data with these providers only as needed to run the service:

Payment providers you connect yourself in FormsBat, BooksBat or Buildan.app, such as your own Stripe or PayPal account, receive payment data under your agreement with them. Some providers process data outside your country, including in the United States. Where required, we rely on standard contractual clauses or equivalent safeguards.

Retention and deletion

• Guest files are deleted as soon as processing ends.
• Your content is kept until you delete it. Items in a trash are permanently deleted after 30 days.
• Signature envelopes and audit trails are kept for as long as the sender keeps them, because they are the record that a document was signed.
• Deleting your OfficeBats account cancels your plan and removes your profile and your content in every Bats app. Removal from live systems starts immediately and is complete within 30 days.
• Backups are stored with encryption at rest and age out on a rolling schedule, so deleted data disappears from backups within 30 days of deletion.
• Billing records are kept as long as tax and accounting law requires. Security logs are kept for a short period, then deleted.

Copies you sent to other people, such as completed envelopes or invoices, stay with them; we cannot delete those.

Your rights

Depending on where you live, you have rights over your personal information. We offer them to every user:

• Access and portability: download your files and export your data from the apps, or ask us for a copy.
• Correction: change your name and email on your security page, or ask us to correct anything else.
• Deletion: delete your account from your security page, or ask us to delete specific information.
• Objection and restriction, and withdrawing consent wherever we rely on it.

GDPR and UK GDPR: you can also complain to your local data protection authority. CCPA and CPRA (California): you can ask what we collect, ask us to delete or correct it, and you will not be treated differently for using your rights. We do not sell or share personal information for cross context behavioural advertising. PIPEDA (Canada): you can access and correct your information and complain to the Office of the Privacy Commissioner of Canada.

If you filled in a form, received a document to sign, an invoice, or visited a site made by a user of our apps, that user controls that data. Contact them first; we will pass your request to them if you ask us. To use any right, contact [email protected].

Security

All traffic uses TLS (HTTPS with HSTS). Databases and file storage are encrypted at rest by our providers. Passwords are hashed with scrypt, sessions use signed HttpOnly cookies, and you can protect your account with two factor authentication. Read more on our Security page.

Cookies

This website uses only the cookies it needs to work: a session cookie that keeps you signed in, and short lived cookies that protect sign in between OfficeBats and the apps. Your light or dark theme choice is saved in your browser. This website does not use advertising cookies.

Analytics cookies: we use Google Tag Manager (GTM-WQMSBFZS) and Google Analytics to understand how people use officebats.com, so we can improve it. They load only after you accept analytics cookies in the banner, and never on share links or while an app hands sign in over to OfficeBats. Your choice is kept in a cookie_consent cookie for 12 months, and you can change it at any time with Cookie settings in the footer. You can also use the Google Analytics opt out add on.

See the Cookie Policy for details.

Children

OfficeBats and the Bats apps are not intended for children under 16, and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will delete it.

Changes to this policy

If we make a material change, we will update the effective date above and tell signed in users by email or in the app before the change takes effect.

Contact

OfficeBats is responsible for your personal information in OfficeBats and the Bats apps. Email [email protected]. We reply within 30 days, and usually much sooner.